Class Action Lawsuit Says Facebook Emails Aren’t Private

A class action lawsuit accusing Facebook Inc. of violating users’ privacy by using data from their private emails to generate targeted advertisements was filed in California federal court on Monday.

Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who claim the social media company misleads consumers about the privacy of their personal messages. They claim that Facebook’s “representations reflect the promise that only the sender and the recipient or recipients will be privy to the private message’s content, to the exclusion of any other party, including Facebook.” In reality, the class action lawsuit says that the contents of these private messages are mined for the purpose of creating targeted advertisements for the Facebook users.

According to the class action lawsuit, Facebook earned $2.7 billion from targeted advertising sales in 2011.

The plaintiffs allege that Facebook scans private messages for URLs. According to the class action lawsuit, if the private message contains a link to a third-party website with a Facebook “Like” plugin, “Facebook registers up to two ‘Likes’ for that web page via the social media plugin.” Campbell and Hurley argue that Facebook does not disclose its practice of scanning emails to its users, instead taking the scans without their consent. Further, Facebook compiles the data from a variety of platforms to “build and refine user profiles.”

The Facebook email class action lawsuit alleges that Facebook hides this practice from its users, but it is “candid” about its activities when communicating with web developers. The plaintiffs allege that Facebook uses sophisticated data aggregation techniques to create advertisements specifically targeted to individual users. They argue that the collection of aggregate data from users in a variety of online platforms can have unintended consequences.

“Representing to users that the content of Facebook messages is ‘private’ creates an especially profitable opportunity for Facebook, because users who believe they are communicating on a service free from surveillance are likely to reveal facts about themselves that they would not reveal had they known the content was being monitored,” the class action lawsuit says. “Thus, Facebook has positioned itself to acquire pieces of the users’ profiles that are likely unavailable to other data aggregators.”

Once acquired, this data can be resold to other companies that are not bound by the same terms and conditions. “This puts people at risk of crime, discrimination, or embarrassment, and they are powerless to stop it because once a company like Facebook obtains their data, users have no control over subsequent analysis, sale, or other use of the data,” the class action lawsuit says.

“Widespread dissemination of information about individuals empowers the government against citizens to a degree well beyond the contemplation of the Fourth Amendment,” the class action lawsuit says. “Facebook declares that it only provides the stored contents of any account to the government with a warrant, yet it has been reported that the companies that purchase such information can hand it over to government agencies with no probable cause and no warrant.”

The Facebook email class action lawsuit charges Facebook with violations of the Electronic Communications Privacy Act, California’s Invasion of Privacy Act, and the California Unfair Competition Law. The plaintiffs seek to represent a nationwide class of Facebook users who have sent or received private messages that contained URLs for third-party web pages in the last two years.

The plaintiffs are represented by Michael W. Sobol, Melissa Gardner, Rachel Geman and Nicholas Diamond of Lieff Cabraser Heimann & Bernstein LLP and Allen Carney, Hank Bates and David Slade of Carney Bates & Pulliam PLLC.

The Facebook Email Privacy Class Action Lawsuit is Campbell, et al. v. Facebook Inc., Case No. 4:13-cv-05996, in the U.S. District Court for the Northern District of California.

UPDATE: On June 17, 2014, Facebook filed a motion to dismiss the message privacy class action lawsuit, arguing that the plaintiffs failed to state a claim under the Wiretap Act. 

UPDATE 2: On Feb. 22, 2016, the lead plaintiffs filed a motion in California federal court asking for class certification.

UPDATE 3: On Aug. 2, 2016, the plaintiffs demanded Facebook hand over more source code and documents than the company has already divulged, as well as configuration tables for certain databases.

UPDATE 4: On March 1, 2017, Facebook agreed to settle this class action lawsuit. Under the terms of the proposed settlement, the social networking giant will not offer monetary compensation to Class Members, but it has agreed to stop using Facebook users’ private message data for targeted advertising purposes.

UPDATE 5: On March 3, 2020, an objection claiming that the Facebook privacy class action provided only “worthless injunctive relief” was rejected by the Ninth Circuit Court of Appeals.